topic Re: Firepower Access Controll Policy logging in Network Security

Firepower Access Controll Policy logging

dejan_jov1 — Fri, 21 Feb 2020 15:31:57 GMT

Hi,

how can I send Syslog messeages of Access Control Rule to an external Syslog Server? I need to see which connections are Blocked or Allowed for specific Rules. In logging settings for Access Controll Rule I can configure Syslog Alert but I don't see any messages on Syslog server. I think that I have problem with selecting the right Facility but can't choose the right one. Thanks in advance!

Re: Firepower Access Controll Policy logging

Marvin Rhoads — Mon, 19 Mar 2018 15:37:51 GMT

The default facility is normally OK unless your target syslog server has some specific setup.

Have you checked the syslog server to see if it is receiving packets on udp/514 from your FMC?

Re: Firepower Access Controll Policy logging

dejan_jov1 — Mon, 19 Mar 2018 16:29:26 GMT

Thanks for reply!

I think i'm hitting some bug. I noticed that in Policies>Actions>Alerts the syslog action was "not in use" even it was selected in few Rules. So I tried to deselect the syslog config from all my Access Control Rules than to deploy that configuration and after selecting the same syslog config on my rules and after deploying the syslog server suddenly it worked!